Left nav

Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Righ nav

".ICU" Fraudulent and Cloned Websites or Domain Names

.ICU Fraudulent and Cloned Websites or Domain Names

Online users are asked to beware of some websites that have names ending with ".icu". This is because scammers/cybercriminals are abusing the Top Level Domain(TLD), by creating fake, fraudulent, phishing and malicious websites with names ending with ".icu". We have even seen popular websites been cloned that have names ending with ".icu", which cybercriminals use to trick their potential victims into visiting, thinking they are on the legitimate websites.

Advertisements - Continue reading below

Here is an example:

Cybercriminals can clone or create a fake copy of "www.yahoo.com", call the cloned version of the website "www.yahoo.icu". Many online users who are tricked into visiting the fake website, would not notice the “.icu” at the end of the name, or may even think Yahoo is using a new website domain name. Therefore, they would think they are on the legitimate Yahoo website. But, any attempts to sign into the fake website by visitors, will result in their Yahoo usernames and passwords being sent to the cybercriminals responsible for the website, who will use the stolen credentials to hijack the visitors' email accounts, which will be used fraudulently.

Online users who think they were tricked into visiting phishing websites that steal online usernames and password, should change their passwords immediately before their accounts are hijacked and used fraudulently.

We are not saying all websites with names ending with “.icu” are dangerous. We just want online users to be aware of those fraudulent “.icu” Top Level Domain name(TLD) websites, which are being created by hackers, scammers and other cybercriminals.

Check the comment section below for additional information, share what you know, or ask a question about this article by leaving a comment below. And, to quickly find answers to your questions, use our search engine.Search
Write commentWrite your comment or view the ones below.    +
Was this article helpful?
Advertisements - Continue reading below

Comments, Answers, Reviews or Questions

To protect your privacy, please remove sensitive or identifiable information from your comments, questions, or reviews. Please keep conversations courteous and on-topic.

Comments 89

Sep 16, 2025 at 7:46 AM by
".ICU" Fraudulent and Cloned Websites or Domain Names
an anonymous user from: São Paulo, Brazil

I recently met a man on the OKcupid app.

After a week of conversation, he commented that he was investing in an online store, which was still in the Beta version and sent me the link with ICU domain, and passed his username and password.

I was suspicious and researched about this domain.

As I'm Brazilian here there are still no records, it was through this site that I realized that I was being a victim of a digital scam.

I blocked the man immediately.

I leave this comment as a warning for women and men to be careful and not trust suspicious links.

Delete

Feb 22, 2020 at 9:03 AM by
".ICU" Fraudulent and Cloned Websites or Domain Names
an anonymous user from: Bradenton, Florida, United States

As far as I can tell, all “.icu” websites are fake or phishers. How do I block ICU websites?

Delete

Feb 22, 2020 at 9:41 AM by
".ICU" Fraudulent and Cloned Websites or Domain Names
info

Use can use DNS service websites like www.safedns.com that can block a specific top-level domain name.

Delete

Oct 26, 2019 at 7:27 AM by
".ICU" Fraudulent and Cloned Websites or Domain Names
info

"I have been receiving pornographic requests from the following:

ivanbewjou-fenceozipsrnwbiei.icu

It is possible that the combination of the r and the n, should be an m, but I did the best that I could. The emails that they send have an unsubscribe feature near the bottom, but when I click on it, nothing happens."

Received via email.

Delete

Oct 5, 2019 at 4:13 AM by
".ICU" Fraudulent and Cloned Websites or Domain Names
an anonymous user from: Winslow, Maine, United States

Cpopsa.icu from Facebook is a totally different website than using a regular browser to access with all different products

Delete

Aug 6, 2019 at 11:19 PM by
".ICU" Fraudulent and Cloned Websites or Domain Names
info

soldierdozen.icu
citizenshoot.icu
energyofsun.icu
graphicbrown.icu
sessionbraid.icu
certainquota.icu
whisperpatch.icu
councilcover.icu
troublewoman.icu
societymatch.icu
factorywiden.icu
chapterdance.icu
regulartrack.icu
minimumsplit.icu
insightstamp.icu
abridgepoint.icu
blackkoran.icu
questround.icu
pupilarena.icu
ownerwatch.icu
deathcrime.icu

More websites sending spam.

Delete

Advertisements - Continue reading below

waiting

Write Your Comment, Answer, Review or Question

".ICU" Fraudulent and Cloned Websites or Domain Names